Ajax Security Team

New Core Impact Backdoor Delivered Via VMWare Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Core Impact Backdoor Delivered Via VMWare Vulnerability

Social Engineering Remains Key Tradecraft for Iranian APTs

Malpedia library date Insikt Group® fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Social Engineering Remains Key Tradecraft for Iranian APTs

Experts warn of a spike in APT35 activity and a possible link to Memento ransomware op

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Experts warn of a spike in APT35 activity and a possible link to Memento ransomware op

VB2021 paper: UNC788: Iran’s decade of credential harvesting and surveillance operations

file creation date fromORKL

Archived copy on ORKL Detailsfor VB2021 paper: UNC788: Iran’s decade of credential harvesting and surveillance operations

SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group

Current Iran-Associated Cyber Threats

file creation date Symantec fromORKL

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Current Iran-Associated Cyber Threats

European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor European Energy Sector Organization Targeted by PupyRAT Malware in Late 2019

GitHub - n1nj4sec/pupy: Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - n1nj4sec/pupy: Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

New steps to protect customers from hacking - Microsoft On the Issues

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New steps to protect customers from hacking - Microsoft On the Issues

New steps to protect customers from hacking

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New steps to protect customers from hacking

Sealing.pdf?fbclid=IwAR1HMnynb0AaGyCI-8ejHjH-pNORfuHYOzQdsTrSpin2eRww6rRh-6VK2SI

file creation date fromORKL

Archived copy on ORKL Detailsfor Sealing.pdf?fbclid=IwAR1HMnynb0AaGyCI-8ejHjH-pNORfuHYOzQdsTrSpin2eRww6rRh-6VK2SI

OVERRULED: Containing a Potentially Destructive Adversary | Mandiant

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OVERRULED: Containing a Potentially Destructive Adversary | Mandiant

Blackgear Cyberespionage Campaign Resurfaces, Abuses Social Media for C&C Communication

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Blackgear Cyberespionage Campaign Resurfaces, Abuses Social Media for C&C Communication

Iran’s Cyber Ecosystem- Who Are the Threat Actors-

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iran’s Cyber Ecosystem- Who Are the Threat Actors-

Iran_Cyber_Final_Full_v2

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iran_Cyber_Final_Full_v2

Charming Kitten: Iranian Cyber Espionage Against Human Rights Activists

Malpedia library date Clearsky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Charming Kitten: Iranian Cyber Espionage Against Human Rights Activists

Anomali - Iran Country Profile relating to Security.pdf

file creation date fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Anomali - Iran Country Profile relating to Security.pdf

Operation Wilted Tulip – Exposing a Cyber Espionage Apparatus – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Wilted Tulip – Exposing a Cyber Espionage Apparatus – ClearSky Cyber Security

Operation Wilted Tulip

Malpedia library date Clearsky fromORKL

Archived copy on ORKL Detailsfor Operation Wilted Tulip

Magic Hound Campaign Attacks Saudi Targets - Palo Alto Networks Blog

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Magic Hound Campaign Attacks Saudi Targets - Palo Alto Networks Blog

Iranian hackers behind the Magic Hound campaign linked to Shamoon

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Iranian hackers behind the Magic Hound campaign linked to Shamoon

Iranian hackers behind the Magic Hound campaign linked to Shamoon

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian hackers behind the Magic Hound campaign linked to Shamoon

Magic Hound Campaign Attacks Saudi Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Magic Hound Campaign Attacks Saudi Targets

Magic Hound Campaign Attacks Saudi Targets

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Magic Hound Campaign Attacks Saudi Targets

Magic Hound Campaign Attacks Saudi Targets

date in the CCS '25 data Palo Alto Networks fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Magic Hound Campaign Attacks Saudi Targets

Magic Hound Campaign Attacks Saudi Targets

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Magic Hound Campaign Attacks Saudi Targets

iKittens: Iranian Actor Resurfaces with Malware for Mac (MacDownloader)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor iKittens: Iranian Actor Resurfaces with Malware for Mac (MacDownloader)

iKittens- Iranian Actor Resurfaces with Malware for Mac (MacDownloader)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor iKittens- Iranian Actor Resurfaces with Malware for Mac (MacDownloader)

Rocket Kitten

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rocket Kitten

Rocket Kitten

Malpedia library date fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Rocket Kitten

2a_15GlobalThreatReport_Extracted.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2a_15GlobalThreatReport_Extracted.pdf

Malware Posing as Human Rights Organizations (Iran Threats: Documenting Iranian State Sponsored Hacking)

date in the CCS '25 data RSA fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Posing as Human Rights Organizations (Iran Threats: Documenting Iranian State Sponsored Hacking)

us-16-Guarnieri-Anderson-Iran-And-The-Soft-War-For-Internet-Dominance-paper

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor us-16-Guarnieri-Anderson-Iran-And-The-Soft-War-For-Internet-Dominance-paper

Cyber warfare_ Iran opens a new front - FT

date in the CCS '25 data Financial Times (FT) fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cyber warfare_ Iran opens a new front - FT

Cylance%20-%20Operation%20Cleaver%20Report.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cylance%20-%20Operation%20Cleaver%20Report.pdf

15GlobalThreatReport.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor 15GlobalThreatReport.pdf

Rocket Kitten: A Campaign With 9 Lives

Malpedia library date Checkpoint fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Rocket Kitten: A Campaign With 9 Lives

The Spy Kittens Are Back: Rocket Kitten 2

date in the CCS '25 data Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Spy Kittens Are Back: Rocket Kitten 2

London Calling- Two-Factor Authentication Phishing From Iran

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor London Calling- Two-Factor Authentication Phishing From Iran

Thamar-Reservoir-public.pdf

file creation date fromORKL

Archived copy on ORKL Detailsfor Thamar-Reservoir-public.pdf

Thamar Reservoir – An Iranian cyber-attack campaign against targets in the Middle East – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Thamar Reservoir – An Iranian cyber-attack campaign against targets in the Middle East – ClearSky Cyber Security

An Iranian Cyber-Attack Campaign Against Targets In The Middle East

date in the CCS '25 data Clearsky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor An Iranian Cyber-Attack Campaign Against Targets In The Middle East

Thamar Reservoir – An Iranian cyber-attack campaign against targets in the Middle East

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Thamar Reservoir – An Iranian cyber-attack campaign against targets in the Middle East

Operation Woolen-Goldfish When Kittens Go Phishing

Malpedia library date Trend Micro fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Woolen-Goldfish When Kittens Go Phishing

Rocket Kitten Showing Its Claws: Operation Woolen-GoldFish and the GHOLE campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rocket Kitten Showing Its Claws: Operation Woolen-GoldFish and the GHOLE campaign

Rocket Kitten Showing Its Claws- Operation Woolen-GoldFish and the GHOLE campaign

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Rocket Kitten Showing Its Claws- Operation Woolen-GoldFish and the GHOLE campaign

Global Threat Intel Report

Malpedia library date Crowdstrike fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report

Cylance_Operation_Cleaver_Report

date in the CCS '25 data Cylance fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cylance_Operation_Cleaver_Report

Gholee – a “protective edge” themed spear phishing campaign – ClearSky Cyber Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gholee – a “protective edge” themed spear phishing campaign – ClearSky Cyber Security

Operation Saffron Rose

file creation date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Saffron Rose

Operation Saffron Rose

file creation date fromORKL

Archived copy on ORKL Detailsfor Operation Saffron Rose

Sayad (Flying Kitten) Infostealer - malware analysis

date in the CCS '25 data Vinsula fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Sayad (Flying Kitten) Infostealer - malware analysis

Molerats, Here for Spring!

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Molerats, Here for Spring!

Operation Saffron Rose

date in the CCS '25 data FireEye fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Saffron Rose

Cat Scratch Fever- CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cat Scratch Fever- CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN

CrowdStrike Tracks Reported Iranian Actor as FLYING KITTEN

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CrowdStrike Tracks Reported Iranian Actor as FLYING KITTEN

Cat Scratch Fever: CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN » Adversary Manifesto

date in the CCS '25 data Crowdstrike fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Cat Scratch Fever: CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN » Adversary Manifesto